PrivateGPT < 0.5.0 - Open Redirect

ID: CVE-2024-5936

Severity: medium

Author: ctflearner

Tags: cve2024,cve,private-gpt,redirect

Description

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the ‘file’ parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization.

YAML Source

id: CVE-2024-5936

info:
  name: PrivateGPT < 0.5.0 - Open Redirect
  author: ctflearner
  severity: medium
  description: |
    An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization.
  reference:
    - https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d
    - https://drive.google.com/file/d/1Fw5eT-9bAqsqzNUqdTXebtqIo5NI6T48/view
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5936
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-5936
    cwe-id: CWE-601
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"private gpt"
    product: private-gpt
  tags: cve2024,cve,private-gpt,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/file=https://oast.me"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)oast\.me.*$'
# digest: 490a0046304402205d5aa506fb0692d247919747ee2db631e9aca02a1ccbba16ae6cb6a587449e0a022022bab736c124cac9211f8e94cfa7a4bc9d43f933929f854a59fd2f0272b9f9e3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-5936.yaml"

View on Github